Police arrest 354 suspects in dark web cybercrime crackdown

dark web cybercrime crackdown is now the target of an action by Department of Justice.

Authorities arrested 354 suspects in a joint international operation targeting vendors and buyers on the Archetyp, Nemesis, Tor2Door, Bohemia, and Kingdom dark web marketplaces.

Codenamed 'Operation TorNado,' this law enforcement action ran from May 2025 to October 2026 and involved agencies from 14 countries.

Additionally, law enforcement targeted vendors and buyers active on forums, single-vendor shops, and encrypted messaging services.

They seized over €60 million ($66 million) in cash and cryptocurrency, 950 kilograms of illicit drugs (including amphetamines, cocaine, ketamine, psilocybin mushrooms, MDMA, and cannabis), and 57 firearms in Europe.

Law enforcement authorities also seized more than 4.8 metric tonnes of illicit drugs, 152 firearms, and over €150 million ($166 million) in the United States.

Past victims of dark web cybercrime crackdown are not made whole by this action alone, and anyone still running systems compromised before this action remains affected.

In April 2022, US authorities and German police also took down Hydra, the world's largest dark web marketplace at the time, with more than 19,000 seller accounts that were serving over 17 million customers worldwide.

Adaptive Security's AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.

Taking down the infrastructure is real progress, but the skills and the playbook behind it don't disappear with the servers -- treat this as a disruption, not a resolution.

This is still an active investigation, not a settled case -- the specifics here may firm up, soften, or change entirely as more comes out.

Operation TorNado follows several similar actions over the last six years, including DisrupTor in 2020 (which led to 179 arrests) and Dark Huntor in 2021 (in which 150 more high-volume darknet vendors were apprehended).

This action was brought by Department of Justice, which is the body to watch for further updates, with international cooperation across multiple jurisdictions.

dark web cybercrime crackdown is now dealing with an active legal process, with Department of Justice leading the action.

National authorities conducted independent investigations with Europol's support, including cross-checks via SIENA and forensic analysis, Europol said.

If your environment shows any indicators associated with dark web cybercrime crackdown, don't assume this action alone removed that exposure -- check for persistence regardless of the takedown.

Treat this as a disruption worth noting, not a reason to deprioritize monitoring for the same group's affiliates or rebrands.